aur-audit

#!/usr/bin/env bash
# aur-audit - Interactive Zero-Trust AUR Package Auditor v1.1.6

set -euo pipefail

# Hardcoded for maximum execution speed (0.1ms builtin check)
AUDIT_SKILL_FILE="$HOME/.config/fetch/skills/system/aur-audit.md"
ALIAS_AI_SCRIPT="$HOME/.config/fetch/ai-agent.py"

# 1. Print Dedicated AUR Audit Skill Profile (if available)
if [ -f "$AUDIT_SKILL_FILE" ]; then
    cat "$AUDIT_SKILL_FILE"
    echo ""
    echo "---"
    echo ""
fi

# 2. Prompt the user interactively for the package name with Readline editing enabled
read -e -p "❯ Enter AUR package name to audit: " PKG_NAME

# Clean trailing whitespace
PKG_NAME=$(echo "$PKG_NAME" | xargs 2>/dev/null || echo "$PKG_NAME")

if [ -z "$PKG_NAME" ]; then
    echo "❌ Error: No package name was provided."
    exit 1
fi

# 3. Fetch package specifications with an active, rotating terminal spinner
echo -ne "⠋ Fetching AUR repository data for: \033[1;33m$PKG_NAME\033[0m...\r"
TEMP_DIR=$(mktemp -d)
trap 'rm -rf "$TEMP_DIR"' EXIT

# Run git clone in the background so we can spin
git clone --depth 1 "https://aur.archlinux.org/$PKG_NAME.git" "$TEMP_DIR" >/dev/null 2>&1 &
CLONE_PID=$!

# Dynamic spinner loop
spin='⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏'
i=0
while kill -0 "$CLONE_PID" 2>/dev/null; do
    i=$(( (i+1) % 10 ))
    echo -ne "\r${spin:$i:1} Fetching AUR repository data for: \033[1;33m$PKG_NAME\033[0m..."
    sleep 0.1
done

# Gather exit code of background clone
wait "$CLONE_PID"
CLONE_STATUS=$?

if [ "$CLONE_STATUS" -ne 0 ]; then
    echo -e "\x1b[2K\r❌ [CRITICAL ERROR] Failed to retrieve package data for \"$PKG_NAME\"."
    echo "   Ensure your network is active or verify that the package exists on the AUR."
    exit 1
fi

# Compile metadata locally
METADATA=""
if [ -f "$TEMP_DIR/.SRCINFO" ]; then
    while IFS='=' read -r key val; do
        # Cleanly strip leading/trailing spaces and tabs from .SRCINFO keys and values
        key=$(echo "$key" | tr -d ' \t' 2>/dev/null || echo "$key")
        val=$(echo "$val" | sed -e 's/^[ \t]*//' -e 's/[ \t]*$//' 2>/dev/null || echo "$val")
        
        if [ -n "$key" ] && [ -n "$val" ]; then
            case "$key" in
                pkgdesc) METADATA="$METADATA* **Description**: $val"$'\n' ;;
                pkgver) METADATA="$METADATA* **Version**: $val"$'\n' ;;
                url) METADATA="$METADATA* **Upstream URL**: \`$val\`"$'\n' ;;
                license) METADATA="$METADATA* **License**: $val"$'\n' ;;
                depends) METADATA="$METADATA* **Dependency**: \`$val\`"$'\n' ;;
            esac
        fi
    done < "$TEMP_DIR/.SRCINFO"
fi

PKGBUILD_CONTENT=""
if [ -f "$TEMP_DIR/PKGBUILD" ]; then
    PKGBUILD_CONTENT=$(cat "$TEMP_DIR/PKGBUILD")
else
    echo -e "\x1b[2K\r❌ Error: PKGBUILD file was missing from the cloned repository."
    exit 1
fi

# Clear spinner line
sys_stderr_write() {
    python3 -c "import sys; sys.stderr.write(\"$1\"); sys.stderr.flush()"
}
sys_stderr_write "\r\x1b[2K\r"

# 4. Formulate the zero-trust system prompt
PROMPT="Please perform a highly rigorous, zero-trust security audit on this AUR package based on your system guidelines.

### 1. Package Metadata Overview
$METADATA
* **Source Integrity**: Bypassed Anubis Anti-Bot Proxy successfully via Git Secure-Clone.

### 2. PKGBUILD Build Script Source
\`\`\`bash
$PKGBUILD_CONTENT
\`\`\`"

# 5. Handoff to AI Agent or output raw data depending on active context
if [ "${AI_CONTEXT_RUN:-0}" -eq 1 ]; then
    # If running as background context, output the raw compiled prompt and exit
    echo "$PROMPT"
else
    # If running directly in the terminal, notify the user of the active prefill math
    echo -e "\033[2m[sys] Ingesting PKGBUILD and auditing with Qwen-35B (prefill processing)..." \033[0m
    python3 "$ALIAS_AI_SCRIPT" --talk "$PROMPT" --aur-audit
fi